The invention relates to programmable logic devices (PLDs) subject to single event upsets. More particularly, the invention relates to structures and methods of generating high reliability designs for PLDs on which single event upsets have minimal impact.
Programmable logic devices (PLDs) are a well-known type of digital integrated circuit that can be programmed to perform specified logic functions. One type of PLD, the field programmable gate array (FPGA), typically includes an array of configurable logic blocks (CLBs) surrounded by a ring of programmable input/output blocks (IOBs). Some FPGAs also include additional logic blocks with special purposes (e.g., DLLs, RAM, and so forth).
The various logic blocks are interconnected by a programmable interconnect structure that includes a large number of programmable interconnect lines (e.g., metal wires). The interconnect lines and logic blocks are interconnected using programmable interconnect points (PIPs). A PIP can be, for example, a CMOS passgate. When the passgate is turned on (i.e., the PIP is enabled), the two nodes on either side of the passgate are electrically connected. When the passgate is turned off (i.e., the PIP is disabled), the two nodes are isolated from each other. Thus, by controlling the values on the gate terminals of the PIPs, circuit connections can be easily made and altered.
PIPs can be implemented in many different ways. For example, a buffered PIP can be implemented as a tristate buffer. When the tristate signal is low, the buffer output is not driven, and the two nodes on either side of the buffer are isolated. When the tristate signal is high, one of the nodes drives the other node in a unidirectional connection.
Various exemplary types of PIPs are described by Freeman in U.S. Pat. No. Re. 34,363, by Carter in U.S. Pat. Nos. 4,695,740 and 4,713,557, by Hsieh in U.S. Pat. No. 4,835,418, and by Young in U.S. Pat. No. 5,517,135, all of which are hereby incorporated by reference. Some PIPs are unidirectional and some are bidirectional. Some are buffered and some are not buffered. However, the various types of PIPs typically have this in common, that they are controlled by a single data value stored in a memory cell called a configuration memory cell.
The logic blocks and PIPs in a PLD are typically programmed (configured) by loading configuration data into thousands of configuration memory cells that define how the CLBs, IOBs, and interconnect lines are configured and interconnected. In Field Programmable Gate Arrays (FPGAs), for example, each configuration memory cell is implemented as a static RAM cell.
When subjected to unusual conditions such as cosmic rays or bombardment by neutrons or alpha particles, a static RAM cell can change state. For example, a stored high value can be inadvertently changed to a low value, and vice versa. Sometimes these xe2x80x9csingle event upsetsxe2x80x9d have no effect on the functionality of the chip. At other times, a single event upset can change the function of a PLD such that the circuit no longer functions properly.
FIG. 1 shows a portion of a PLD that includes three logic blocks LB1-LB3, five interconnect lines IL0-IL4, and four PIPS P1-P4. Interconnect lines IL1-IL3 are coupled to logic blocks LB1-LB3, respectively. For simplicity, interconnect lines IL1-IL3 are shown directly connected to the corresponding logic blocks. In practice, the interconnect lines do not necessarily connect directly to the logic blocks, but can pass through additional PIPs to reach the logic blocks. Interconnect lines IL1-IL3 can each be programmably coupled to interconnect line IL0 through PIPs P1-P3, respectively. Interconnect line IL4 can be programmably coupled to interconnect line IL3 through PIP P4.
PIPs P1-P4 are respectively controlled by four memory cells MC1-MC4. When the value stored in one of the memory cells is high, the passgate in the associated PIP is enabled. When the value stored in one of the memory cells is low, the interconnect lines on either side of the associated PIP are not connected together. They can be left unconnected or wired as parts of two separate circuits.
As an example, consider the case where memory cells MC1, MC2, and MC4 each store a high value and memory cell MC3 stores a low value. PIPs P1 and P2 are enabled, connecting together interconnect lines IL1, IL0, and IL2. PIP P4 is also enabled, connecting together interconnect lines IL3 and IL4. PIP P3 is disabled. Further consider that logic block LB1 is driving a signal on interconnect line IL1 and logic block LB3 is driving a signal on interconnect line IL3. For example, PIPs P1 and P3 can be included in output drivers of the CLBs including logic blocks LB1 and LB3, respectively. PIPs P1-P4 can also form part of multiplexer structures within logic blocks or CLBs, or within the programmable interconnect structure of the PLD.
Now suppose a single event upset occurs at memory cell MC1, and the value stored in memory cell MC1 changes from a high value to a low value. PIP P1 is inadvertently disabled, and interconnect line IL1 is isolated from interconnect line IL0. If logic block LB1 was driving logic block LB2 through interconnect line IL0, for example, the connection no longer exists, and the circuit does not function properly.
Suppose instead that a single event upset occurs at memory cell MC3 and the value stored in memory cell MC3 changes from a low value to a high value. PIP P3 is inadvertently enabled. Logic block LB3 tries to place a value on interconnect line IL0, which is already driven by logic block LB1. Contention occurs, which can cause a number of problems ranging from excessive current consumption to a malfunctioning circuit to causing actual damage to the PLD.
Circuits and methods have been developed to avoid the problems associated with single event upsets in non-programmable circuits. One strategy for avoiding such problems is illustrated in FIG. 2. The illustrated circuit is called a triple modular redundancy (TMR) circuit. In essence, the required logic is implemented three times (i.e., in three modules), and the results generated by the three modules are compared. The two that are the same are considered to be correct, and the xe2x80x9cdissenting votexe2x80x9d is thrown out.
The TMR circuit of FIG. 2 includes modules M1-M3, representing three implementations of the same logical function. Each module has a respective output signal O1-O3 that drives voting circuit VC3. Voting circuit VC3 implements the function (O1 AND O2) OR (O2 AND O3) OR (O1 AND O3) and provides the result as the output signal OUT of the circuit.
Clearly, this approach overcomes any single event upset that affects the functionality of one of the three modules M1-M3. The module affected by the event produces an incorrect answer, which is overridden in the voting circuit by the other two modules.
Kwak and Kim extend the TMR concept to embrace time-multiplexed modular redundancy in xe2x80x9cTask-Scheduling Strategies for Reliable TMR Controllers Using Task Grouping and Assignmentxe2x80x9d, published in the December 2000 issue of IEEE Transactions on Reliability, Vol. 49, No. 4, pages 355-362, which pages are hereby incorporated by reference. Kwak and Kim address the effects of transient errors, rather than permanent errors such as those caused in PLDs by single event upsets. When addressing transient errors, sequentially recalculating a module output, even using the same module, can give different results that can then be resolved by the voting circuit.
In Kwak and Kim""s approach, three modules are included in the circuit, but module output values are calculated five times (TMR-Q) using timing rotation in the three modules. A voting circuit determines the xe2x80x9cmajority votexe2x80x9d for the module output values. Additional calculations can be performed, i.e., N calculations where N is an odd number greater than five (TMR-N).
All of the above methods (TMR, TMR-Q, and TMR-N) address the issue of permanent or transient errors that cause malfunctions within the modules. However, PLDs present some, special issues with regard to single event upsets, because single event upsets can occur not only within the modules, but within the programmable routing that interconnects the modules and the voting circuit. For example, referring to FIG. 2, a single event upset that changes the value stored in a PIP memory cell can short together two of the module output signals O1-O3. In this event, two of the three inputs to the voting circuit can be incorrect.
Further, circuits implemented in a PLD are not necessarily implemented in discrete regions of the device. The best implementation of the circuit of FIG. 2 in terms of performance or minimizing resource usage might be to physically intermix the logic for the three modules M1-M3. In that case, internal nodes in two different modules can easily be separated by only a single disabled PIP. If a single event upset inadvertently enables such a PIP, internal nodes from the two modules are shorted together. Again, two of three modules are providing suspect data to the voting circuit.
Similarly, single event upsets can cause inadvertent connections between a node in one of the modules and a node in the voting circuit, or between two different nodes in a voting circuit, or between nodes in two different voting circuits.
Therefore, it is desirable to provide structures and methods for implementing circuits in PLDs that offer protection from the effects of single event upsets.
The invention provides structures and methods for generating high reliability designs for PLDs on which single event upsets have minimal impact. The structures and methods of the invention address the special issues faced by PLD designers when designing high-reliability circuits, specifically the fact that when standard triple modular redundancy (TMR) is used, a single event upset can short together two module output signals and render two of the three voting circuit input signals invalid. Thus, the advantage provided by the standard TMR circuit is significantly reduced by the programmable nature of the PLD routing.
The invention addresses this issue by providing five modules (quintuple modular redundancy, or QMR) rather than three modules for high-reliability circuits implemented in PLDS. Thus, a single event upset that inadvertently shorts together two PLD interconnect lines can render invalid only two out of five module output signals. The majority of the five modules still provide the correct value, and the voting circuit is able to correctly resolve the error.
According to a first aspect of the invention, a user circuit is implemented in a PLD, where the PLD includes programmable logic blocks, programmable interconnect lines, and programmable interconnect points (PIPs) interconnecting the logic blocks and interconnect lines. A structure implementing the user circuit includes five copies of the user circuit implemented using the logic blocks, interconnect lines, and PIPs; a voting circuit that provides a value common to at least three input terminals at a voting circuit output terminal; and programmable interconnections coupling output terminals of the five copies of the user circuit to corresponding input terminals of the voting circuit via the interconnect lines and PIPs.
According to another aspect of the invention, a method of implementing a user circuit in a PLD includes receiving a circuit description of the user circuit; implementing five copies of the user circuit based on the circuit description and using logic blocks, interconnect lines, and PIPs of the PLD; implementing a voting circuit that provides a value common to at least three input terminals at a voting circuit output terminal; and implementing interconnections between the output terminals of the five copies of the user circuit and corresponding input terminals of the voting circuit via the interconnect lines and PIPs.
In some embodiments, a user selects a high-reliability circuit implementation option, and the PLD implementation software automatically implements the QMR structure. Some PLD software can target multiple PLD architectures, e.g., PLDs controlled by antifuses and PLDs controlled by static RAM memory cells. In some embodiments, such multi-targeting software selects either a TMR or a QMR implementation for the user circuit, depending on characteristics of the target PLD. For example, if the target PLD is controlled by static RAM memory cells, a TMR implementation does not necessarily protect against a single event upset in the programmable routing. Thus, the QMR implementation is automatically selected for the target PLD. However, if the target PLD is antifuse based, a TMR implementation is selected.
Another aspect of the invention provides a method of implementing a user circuit in a PLD, including providing a circuit description of the user circuit, and receiving a PLD implementation for the circuit. The PLD implementation includes five copies of the user circuit implemented using logic blocks, interconnect lines, and PIPs of the PLD; a voting circuit that provides a value common to at least three input terminals at a voting circuit output terminal; and programmable interconnections coupling output terminals of the five copies of the user circuit to corresponding input terminals of the voting circuit via the interconnect lines and PIPs. Some embodiments include providing an indicator selecting a high-reliability QMR implementation for the user circuit. Some embodiments include providing a target selection indicator, on the basis of which a QMR implementation is selected.